Repository navigation
v3.12.3
What's new
Bug Fixes
Agent and command discovery walked every .md file it found, so a plain README.md dropped into agents/<category>/ became a dispatchable agent named README and shipped as a registry component (#816). README is documentation by universal convention and was never meant to be content. Four independent code paths had reimplemented the same "every .md is an agent" rule — runtime agent discovery, command discovery, the overlay inventory that validates user config, and the content-integrity predicate that decides which files must satisfy the agent frontmatter contract — and each had to be corrected. They now share one helper. The integrity gate still scans README files for reference-integrity and banned-pattern checks; only the agent frontmatter contract is relaxed, so a real agent missing temperature: still fails the gate. The issue surfaced while adding a README to agents/review/ to record that the directory is a shared persona pool rather than a review roster.
The same change consolidated the synthesis artifact contract to one canonical home at skills/ce-review/references/synthesis-artifact-contract.md. It previously lived in three places that could drift apart; SKILL.md and review-output-template.md now summarize and link instead of restating the rules, and findings-schema.json remains the executable definition. AGENTS.md also now documents the generated-surface cascade — editing an agent description or body drifts the registry and the Pi persona fixtures, and adding a file under a skill's references/ drifts the registry's per-component file list — each of which was previously discoverable only by hitting a red gate.
Continuous Integration
A content-integrity check now fails the build when prose tells an orchestrator to pass a model argument to the dispatch tool (#815). The dispatch tool accepts a fixed set of arguments, and model is not among them — prose instructing an orchestrator to pass one degrades the dispatch to a generic sub-agent with no configured model, which silently discards the user's per-agent and per-category model assignments. Three instances of this had already shipped; one survived a fix, a ten-persona review, and an automated review pass, and was found only by reading the published package rather than the source tree. The new check requires two co-occurring signals on the same line — a model: <value> assignment written as inline code, and vocabulary indicating a sub-agent dispatch — since either signal alone is ordinary in legitimate content. The vocabulary list deliberately omits the bare word "agent" (used constantly in legitimate docs about "bundled agents"), and model: inherit is exempted as a frontmatter literal that skills must name precisely in order to prohibit it. Requiring the assignment to sit inside an inline-code span, rather than merely following a colon, separates a real code-shaped argument from ordinary prose that would otherwise trip a false positive on a gate with no advisory channel.
The docs build and deploy jobs stopped reinstalling system packages the runner already has (#814). The docs job spent sixty seconds preparing a browser to render two Mermaid diagrams and only ten seconds building the site itself — almost all of that cost came from Playwright's --with-deps flag, which runs apt-get update and installs CJK, Thai, and Cyrillic fonts plus a fontconfig trigger pass for diagrams whose labels are English. The flag is dropped; if a required library ever does go missing, Chromium now fails at launch instead of degrading quietly, keeping the failure visible. The remaining cost — the browser binary download — is now cached against the lockfile that pins Playwright, so a cache hit skips it and only a version bump triggers a fresh download. The same treatment was applied to the docs deploy job.
Documentation
Three release and verification learnings were captured in docs/solutions/ (#812). A release run had reported success while publishing nothing: the job conclusion was green, and the release tool's own closing line named a version and channel that did not exist in the registry, because that line prints in dry-run mode too — two workflow defects produced it, each hiding the other, so the behavior split by branch while ignoring the caller's input in both directions. Separately, verification delegated into a fresh worktree had reported a malformed dependency import and three dozen failing tests that turned out to be an empty node_modules, not real breakage — a brief that names a fresh environment now has to name its preparation too, and has to let the reply distinguish a gate that failed from a gate that could not run. And publishing a fix for an older major was documented as resting on one fact: dist-tags play no part in semver range resolution, so a consumer on a caret range receives the newest matching version whether or not a tag points at it, which allows a one-shot release under a throwaway tag that is then deleted, leaving the default install untouched. The existing document on measured counts also gained a second instance — a test suite reading the developer's own config file showed the configuration factor escaping version control, not just the filesystem factor it previously named alone.